Ubuntu
krb5 package

Change logs for krb5 source package in Dapper

Dapper (6.06)
Change log

krb5 (1.4.3-5ubuntu0.12) dapper-security; urgency=low

  * SECURITY UPDATE: message forgery and privilege escalation via
    unacceptable checksums
    - src/lib/crypto/krb/dk/derive.c, src/lib/crypto/krb/keyed_checksum_types.c,
      src/lib/krb5/krb/mk_safe.c, src/lib/krb5/krb/preauth2.c,
      src/plugins/preauth/pkinit/pkinit_srv.c: patched inline, thanks to
      upstream.
    - CVE-2010-1323
    - MITKRB5-SA-2010-007
 -- Marc Deslauriers <email address hidden>   Wed, 08 Dec 2010 10:39:39 -0500

krb5 (1.4.3-5ubuntu0.11) dapper-security; urgency=low

  * SECURITY UPDATE: unauthenticated remote attacker can crash kadmind.
    - debian/patches/MITKRB5-SA-2010-005: applied upstream fixes inline
    - CVE-2010-1321
  * SECURITY UPDATE: potential service crashes.
    - applied inline, backported from upstream svn:
      - debian/patches/CVE-2007-5902
      - debian/patches/CVE-2007-5971
      - debian/patches/CVE-2007-5972
 -- Kees Cook <email address hidden>   Tue, 18 May 2010 15:54:52 -0700

krb5 (1.4.3-5ubuntu0.10) dapper-security; urgency=low

  * SECURITY UPDATE: unauthenticated remote attacker can crash or
    compromise the KDC via flaws in AES and RC4 decryption (CVE-2009-4212).
    - debian/patches/MITKRB5-SA-2009-004 backported and applied inline.
    - http://web.mit.edu/kerberos/advisories/2009-004-patch_1.6.3.txt
 -- Kees Cook <email address hidden>   Mon, 11 Jan 2010 14:40:21 -0800

krb5 (1.4.3-5ubuntu0.8) dapper-security; urgency=low

  * SECURITY UPDATE: denial of service via memory corruption.
    - src/lib/krb5/asn.1/asn1_decode.c: ASN.1 decoder freed uninitialized
      pointers (MITKRB5-SA-2009-002: CVE-2009-0846).

 -- Kees Cook <email address hidden>   Tue, 07 Apr 2009 12:47:50 -0700

krb5 (1.4.3-5ubuntu0.7) dapper-security; urgency=low

  * SECURITY UPDATE: arbitrary code execution via freed pointer and memory
    overflows.
  * src/kdc/{kerberos_v4,dispatch,network}.c: backported upstream fixes
    patched inline (MITKRB5-SA-2008-001: CVE-2008-0062, CVE-2008-0063).
  * src/lib/rpc/{svc,svc_tcp}.c: upstream fixed patched inline
    (MITKRB5-SA-2008-002: CVE-2008-0947)

 -- Kees Cook <email address hidden>   Tue, 18 Mar 2008 11:07:13 -0700

krb5 (1.4.3-5ubuntu0.6) dapper-security; urgency=low

  * SECURITY UPDATE: 32 byte stack overflow in rpcsec_gss.
  * src/lib/rpc/svc_auth_gss.c: new upstream changes, patched inline.
  * References
    MIT-SA-2007-06
    CVE-2007-4743

 -- Kees Cook <email address hidden>   Thu, 06 Sep 2007 15:17:40 -0700

krb5 (1.4.3-5ubuntu0.5) dapper-security; urgency=low

  * SECURITY UPDATE: stack overflow in rpcsec_gss.
  * src/lib/rpc/svc_auth_gss.c: upstream changes patched inline.
  * References
    MIT-SA-2007-06
    CVE-2007-3999

 -- Kees Cook <email address hidden>   Tue, 04 Sep 2007 11:47:32 -0700

krb5 (1.4.3-5ubuntu0.4) dapper-security; urgency=low

  * SECURITY UPDATE: multiple remote code execution vectors.
  * src/lib/rpc/svc_auth_{gssapi,unix}.c: backported upstream fixes for
    MITKRB5-SA-2007-004 (CVE-2007-2442, CVE-2007-2443).
  * src/kadmin/server/server_stubs.c: backported upstream fixes for
    MITKRB5-SA-2007-005 (CVE-2007-2798).

 -- Kees Cook <email address hidden>   Tue, 19 Jun 2007 15:27:34 -0700

krb5 (1.4.3-5ubuntu0.3) dapper-security; urgency=low

  * SECURITY UPDATE: arbitrary login via telnet, arbitrary code execution
    via syslog buffer overflows, and heap corruption via GSS api.
  * src/appl/telnet/telnetd/{state,sys_term}.c: MIT-SA-2007-1 fix from
    upstream (CVE-2007-0956).
  * src/lib/kadm5/logger.c: MIT-SA-2007-2 fix from Debian, based on
    upstream fixes (CVE-2007-0957).
  * src/lib/gssapi/krb5/k5unseal.c: MIT-SA-2007-3 fix from upstream
    (CVE-2007-1216).
  * References
    http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-001-telnetd.txt
    http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-002-syslog.txt
    http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-003.txt

 -- Kees Cook <email address hidden>   Tue,  3 Apr 2007 15:50:20 -0700

krb5 (1.4.3-5ubuntu0.2) dapper-security; urgency=low

  * SECURITY UPDATE: Remote privilege escalation.
  * src/lib/rpc/svc.c:
    - Do not call an uninitialized pointer.
    - Patch provided by upstream.
    - References:
      CVE-2006-6143
      http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt

 -- Martin Pitt <email address hidden>   Mon, 15 Jan 2007 14:18:44 +0000

krb5 (1.4.3-5ubuntu0.1) dapper-security; urgency=low

  * SECURITY UPDATE: root privilege escalation in systems which restrict the
    number of per-user processes.
  * Added: debian/patches/setuid-fixes
    - verify return from setuid family of calls.
    - applied patch inline (debian/rules does not apply patches automatically)
  * CVE-2006-3083, CVE-2006-3084

 -- Kees Cook <email address hidden>   Thu, 10 Aug 2006 11:30:05 -0700

krb5 (1.4.3-5) unstable; urgency=medium


  * Configure with --enable-shared --enable-static so that libkrb5-dev
    gets static libraries.
  * Fix double free in getting credentials, Closes: #344543

 -- Sam Hartman <email address hidden>  Sun, 25 Dec 2005 21:59:47 -0500

krb5 (1.4.3-4) unstable; urgency=high


  * Fix problem when libpthreads is dynamically loaded into a program
    causing mutexes to sometimes be used and sometimes not be used.  If
    the library starts out without threads support it will never start
    using threads support; doing anything else causes hangs. 

 -- Sam Hartman <email address hidden>  Fri, 16 Dec 2005 18:16:53 -0500

Ubuntukrb5 package

Change logs for krb5 source package in Dapper

Ubuntu
krb5 package